3 ms·

Ergonomic advantages / reduced defect rates != vulnerability issues. The former aren’t a problem for languages like JS which has all sorts of weird sharp edges.

Ergonomic advantages / reduced defect rates != vulnerability issues. The former aren’t a problem for languages like JS which has all sorts of weird sharp edges. But vulnerabilities are treated as a separate risk factor because the issues can spill to unexpected areas which makes risk harder to quantify and reason about. A vulnerability in some small tool that barely anyone uses can be used to exfil your entire customer database or do a ransomeare attack and cost you hundreds of millions of dollars in short term damage + investigations by regulatory bodies and law enforcement. A buggy piece of software at worst causes some bad PR or a failed product which is way way smaller and localized of an issue

phicoh 3y ago
Some classical programming languages that don't suffer from buffer overflow or memory allocation issues, but are horribly unsafe due to type (and other issues) are shell scripts and, at least, early versions of php. Weak type checking at interface boundaries allows for all kinds of errors including vulnerabilities. A famous class of vulnerabilities due to poor type checking is SQL injection.
- pjmlp 3y ago
  SQL injection happens on any language where people decide string concatenation is better than using precompiled query parameters exposed by database drivers APIs. Using Rust doesn't change how those folks keep concatenating strings.